GHSA-q3cm-ccrm-2mr6MediumCVSS 6.5

Moodle Authenticated LFI risk in some misconfigured shared hosting environments

Published
May 31, 2024
Last Modified
March 28, 2025

🔗 CVE IDs covered (1)

CVE-2024-34004 →

📋 Description

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

🎯 Affected products3

  • composer/moodle/moodle:>= 4.3.0, < 4.3.4
  • composer/moodle/moodle:>= 4.2.0, < 4.2.7
  • composer/moodle/moodle:< 4.1.10

🔗 References (3)